Docs / Getting oriented
Where we fit with what you own
You own most of what is needed already. The useful question is which job each product is doing, and which job nothing is doing.
First, the words
Half the confusion in a mixed estate comes from four words that exist in every product and mean something different in each. Worth settling before anything else.
| Word | In Microsoft | In Claude and ChatGPT | In Mindset |
|---|---|---|---|
| Environment | A Power Platform environment. Holds apps, flows and data. Membership set per environment. | No equivalent. One organisation or workspace, and nowhere to build that is not live. | A named partition, normally Test and Production, with its own connections. Unrelated to Power Platform. |
| Organisation | Your Entra tenant. | Your Claude organisation or ChatGPT workspace, where connectors are allowed or not. | Your Mindset organisation. The only boundary, and where the write-approval setting lives. |
| Connection | A Power Platform connection to a connector. | A connector, allowed for everyone or nobody. | A link to one outside system, holding its login details. Six kinds, including an MCP server and a model. |
| Operation | A connector action. | A tool on a connector, or a skill's step. | One specific named thing an agent may do on one connection, marked read or write. |
From here on, every use of these words is prefixed with the product it belongs to. Where this guide says environment without a prefix, it means a Mindset environment.
Access: Who may use which model
Microsoft Entra ID for identity and conditional access. The Microsoft 365 admin centre for Copilot seats, the Claude Enterprise admin console, the ChatGPT Enterprise admin dashboard. Training and attestation on top.
In most estates this part is finished. Seats are bought, managed and attested.
Discovery: What exists that nobody sanctioned
Tenant admin tooling shows what has been created. Microsoft Purview captures prompts and responses and classifies data. A threat detection platform ingests provider telemetry.
A discovery audit in a company of a few hundred people typically turns up several hundred agents.
- Some shipped with an ERP deployment and were never asked for.
- Most were built by business users somewhere nobody was watching, often the Power Platform default environment.
- A handful of MCP server hookups nobody knew about.
That is a discovery layer working correctly, telling you something you cannot act on.
Execution: What a sanctioned agent may do
Which systems an agent reaches, which named operations on those systems, whose credentials it uses, what is recorded, and whether a change happens at all without a person seeing it first.
Execution is the layer nothing in most estates covers. The agents touching real systems do so under the credentials of whoever invoked them, and some of those people hold administrator rights in production. Nothing in the estate can tell an agent action apart from a human one.
Surface: Where people work
- The Mindset Hub for colleagues, in a browser.
- An embedded element inside your own product, for customers.
- MCP, so an agent is reachable from somebody's own Claude or Claude Code.
All three carry the same grant. An agent reached from Claude has exactly the operations it was given, no more and no fewer than from the Mindset Hub.
Environments are the part of this that most often gets confused with something else, so they have an article of their own: Environments.